API testing of the Toolshop (Practice Software Testing, sprint5)
=================================================================

Files in this download
----------------------
toolshop.postman_collection.json        The Postman collection: 17 folders, 349 requests, with tests.
local-docker.postman_environment.json   The environment: baseUrl, adminEmail, adminPassword.
newman-report.html                      The HTML report of the full run (Newman, 355 requests).
                                        Tokens and generated test passwords are masked.
test-catalogue.csv                      One row per request: folder, name, method, path, status, failed assertions.
defect-register.csv                     The 19 defects: ID, severity, title, linked tests.
test-summary-report.pdf                 The written report: results, defects, scope, method, limits.
evidence/                               Five screenshots, cropped to the relevant part.

Requirements
------------
- The Toolshop application (sprint5) running locally on http://localhost:8091.
  The API is reached through Docker. Adjust baseUrl in the environment if your port differs.
- Postman (desktop or web), or Newman 6 or later for the command-line run.

Import into Postman
-------------------
1. Import toolshop.postman_collection.json.
2. Import local-docker.postman_environment.json.
3. Select the environment "Local - Docker" in the top-right corner.
4. Run the folders in order, starting with "00 Setup". Folder 00 creates the test users,
   the cart and the orders that the later folders use.

Run from the command line (Newman)
----------------------------------
Run from the folder that contains the collection and the environment file:

    newman run toolshop.postman_collection.json -e local-docker.postman_environment.json --working-dir fixtures

The folder "fixtures" must contain three small files used by the attachment test (T-H06):
- gol.txt   (an empty text file)
- continut.txt   (any text, for example one line)
- gol.pdf   (an empty file, saved with the .pdf extension)

Important notes
---------------
- Access tokens expire after 5 minutes. A long run will produce 401 responses after that.
  Run the setup requests again before each folder, or run the whole collection quickly.
- Folder "16 Database reset" resets the database to its seed data. Run it last. Every run
  after it must start again from "00 Setup".
- The test "T-J10 · expired token" needs a token that has been expired for at least
  5 minutes. In a full run it fails because the token is still valid. Run it on its own,
  after waiting, to get the expected result.
- "T-H04" is an observation, not a pass/fail check: a message that belongs to another user
  returns 200 with an empty body.
- The test passwords in the collection are generated for local test accounts only.
  They are not real credentials and are not used anywhere else.